The problem with deleting files is that the file data is just one small part of what really gets saved onto your disk. On a modern filesystem there will be lots of metadata and other artifacts scattered around the disk:
- Journal entries on journaling filesystems, e.g. NTFS, ext3, ext4.
- Search index entries.
- Prefetch / superfetch cache entries.
- Shadow copies.
- Image thumbnail caches, e.g. WinXP's thumbs.db / Win7's thumbnail database.
- Temporary files, e.g. from ZIP/RAR extraction.
- Alternate data streams (ADS), e.g. EFS FEK descriptors.
- COM / .NET object registration data.
- Wear leveling sectors on SSDs / USB flash drives.
This presents a challenge. Simply deleting the file data securely will only result in that data being deleted. There's no guarantee that the metadata won't contain sensitive data, or even be enough to reconstruct the entire file or match its hash against that of a known plaintext.
For example, even if the file is deleted we might be able to detect the following:
- The name of the file and when it was created / deleted / modified.
- A cryptographic hash (or checksum, e.g. CRC32) of the file, from an indexing database.
- Occurrence of certain words or phrases inside the file from a search content index.
- Company name, product name, COM object interfaces, .NET namespaces, etc. if it was a PE executable.
- A thumbnail if the file was an image.
- Various metadata from latent alternate data streams.
- Partial plaintext from temporary files and wear leveling sectors.
- Entire plaintext recovery from shadow copies or temporary files.
Identifying the locations of these and appropriately deleting them is cumbersome and may not even be possible in some cases. The best you can do is manually go through and clear any backups, delete the files, clear out your caches, wipe your thumbnail database, then do a
cipher /W pass to ensure that most of it is wiped. Unfortunately even this won't guarantee anything, since some of it is stored in files and structures that are just trimmed or modified instead of properly deleted, resulting in blocks of data that are unlinked from the structure but not wiped.
So how can we get round this? The only real way to do it is with full disk encryption. Use an industry standard like TrueCrypt to encrypt your entire hard disk, using a strong password. Even this isn't 100% foolproof on SSDs with wear-leveling (in which case TRIM and Secure Erase are good options) but it protects you against all relevant practical attacks as long as you're not worried about governments throwing a ludicrous budget at recovering your data.
Of course, if you're really paranoid, the only guaranteed solution is full physical destruction. This is usually achieved using an industrial disk shredder that physically cuts the disk up into little cubes, and often involves a pass through a strong magnetic field. For government and military purposes, these cubes are often melted in a furnace afterwards for good measure.